Very occasional high packet loss

I've been seeing high packet loss for a couple of months which often clears after I restart my router.
The router is scheduled to reboot on Sunday at 2.15 am.

[img]https://www.thinkbroadband.com/broadband/monitoring/...[/img]"]BQM image

I have an Advanced Tomato router connected to a flashed HG612 which has been working for a good few years and I get the max on an 80/20 connection.

Is this likely to be my equipment failing?
I have spare HG612s and will replace the router this week with an APU2 running OPNSense.

So far, after that brief outage shown in the image I have yet to see any further dropped packets this week still running on the old hardware.

Edited by smouty (Tue 13-Apr-21 17:13:16)

The dropped packets returned after around 72 hours.

I replace the router/firewall with OPNSense and the modem with another HG612 I had and it appears to have solved the issue so far.
I cannot recommend OPNSense enough. My connection feels so much faster than it was.
I'm using FQ-Codel for shaping.

https://i.imgur.com/yGIMH2r.png

Edited by smouty (Mon 19-Apr-21 09:42:57)

I'm still waiting for my FTTP to be connected once Kcom sort them selves out so I am still using a HG612 on ADSL2.
I mount mine 1" (25mm) away from the vertical fixing surface on two strips of wood to allow more air to cool the device, that made the modem run a lot cooler and better.

Any modem or router works better when it's not getting hot.

I also use pfSence.

Previously a pfSense user, I also run OPNsense on an APU2 and it's working well for me. Also I just finally got around to setting up Wireguard!

So, good choices IMO! My only note for others is that I could not use the intrusion detection stack (Suricata or Snort) and get over about 100Mbps with the APU2. Since I had just bought the APU2 and was not particularly sure Suricata was important to me I just turned it off and still use the APU2. I do use some geo-blocking. All that to say, someone considering a new set up like this might want to get more CPU power if IDS is desired.

Yeah. I think the HG612 is probably suffering from failing caps or something else.
The case is very yellow compared to the new one I replaced it with and I also swapped out the PSU just in case.

I don't know the exact date but it has an SP06 firmware sticker whereas the replacement has SP10 so could have been my original from years back.
It has been running the unlocked firmware and logging stats ever since.

I've picked a few from car boots for a couple of quid each.

In reply to a post by mrtcs:

All that to say, someone considering a new set up like this might want to get more CPU power if IDS is desired.

I think dedicated hardware would be best e.g Ubiquity devices can do hardware accelerated/offloaded inspection of packets so it doesn't have to hit the CPU as hard. My BQM earlier today looked like a crayon:

My Broadband Ping

This was caused by a peer-to-peer application even though I rate-limit my connection to try to prevent this. The reason this happened though wasn't because of bandwidth usage which was low, it was because of the number of connections this application makes. My router was trying to log hundreds and thousands of connections per second and Linux just sits there and goes "Okay, but this might take a while" and uses 100% CPU, latency goes up and the speed at which printk can output/log becomes a bottleneck (I actually measured this with perf!). As soon as I removed the iptables rule responsible for logging traffic CPU usage decreased and latency returned to normal.

I am going to assume that peer-to-peer application is torrent. If im correct you could think about using these cloud torrent downloading services. It wont fix the fundermental issue at hand, it just option.

https://www.fossmint.com/best-cloud-torrent-service-...

I've already fixed it by getting rid of the extra connection logging I added which I didn't need (it was there to debug something but I forgot about it and this caused serious problems when dealing with high numbers of connections because logging/inspecting traffic is incredibly CPU intensive). I was running the application as an experiment on purpose to test my traffic shaping. If I was shaping correctly then I shouldn't even notice that it's running because the router will drop packets to keep things under control and make sure that one machine isn't monopolising the link and everyone gets their fair share of the connection. It's still running now and I can't even tell, there's some small spikes in my BQM and minor packet loss but the average latency is consistent now and back down to where it should be.

What am intresting in is what happen just before 5 AM? If don't mind me asking.

https://ibb.co/FqXy9zY

Garbage collection usually. Oh you mean in the router? Yeah that too...just taking out the logs 😎😂